Posted
by
kdawson
on Saturday November 13, 2010 @01:46PM
from the dual-use dept.

simonb writes, "In what can only be described as a fit of insanity, the Fedora Board have declared a 'hacker tool' not fit for entry into their software repositories. Today your SQL injection tools, tomorrow your nmap?" The Register links the Fedora board's meeting minutes. From the story: "The move came on Monday in a unanimous vote by the Fedora Project's board of directors rejecting a request that SQLNinja be added to the archive of open-source applications. It came even as a long list of other hacker tools are included in the bundle and was harshly criticized by some security watchers. 'It seems incredibly short sighted to reject software based on perceived legal usage,' said Jacob Appelbaum, a full-time programmer for the Tor Project. 'They have decided to become judges of likely usage based on their own experience. That is a path of madness.' ... [T]he board unanimously decided to add a new statement to Fedora's legal guidelines concerning the inclusion of hacking tools. ... Smith said the language is intended to clarify its stance on a class of software that can be used both to secure and penetrate protected networks."

Ok look. There are two c files that include windows.h Wonder why fedora would care about them...??? It's a couple of crap MSVC console applications. They even give you.exe files in the archive. Might even work in Wine. No compiling necessary, unless you want to port it yourself (Which you don't because you clearly have no clue how to create a make file for yourself).

What else... Oh shit! There's a Perl file there too. Maybe Fedora would be interested in that? (BTW, here's your next clue. You don't

If you have issues with any of the above, you probably shouldn't be running the software anyway. If you can't spot the only file with unix execute permissions named "sqlninja" and another file called "sqlninja-howto.html" then you don't need this software. It doesn't matter if it comes in an RPM or not at that point.

Again, I'll ask. Why would a Linux distribution care about a tool that i

I was going off your second comment where you were moaning about not having a make file and calling that retarded. You don't need a make file for Perl programs you just run them. The other C files are for MSVC (Your not supposed to build them on Linux--No need for a gnu makefile if you're doing the MSVC thing.).

I never claimed anyone had to be programmer, just curious as to how you're supposed to build from source. I didn't realize the "source" distribution included a perl file, amongst other things. Just shows I'm unfamiliar with the package.

Isn't that kind of the point of things being open? That you don't have to agree with the way things are done -- you have the source, change/fix/fork it yourself.

In other words -- non-story. Those that want this specific tool (black, white,or grey hat) will know how to get it. It's not like anyone capable of using such tools cannot handle tar, make, and make install.

might get flamed for this but this is exactly why I love running gentoo. Sources are mostly widely available, if for some reason emerge is throwing a fit about masked packages. Anyways from TFA:

'Argument for SQLninja to be added to Fedora is that it is a 'penetration testing tool.'

I still do not quite understand the grounds here. Honestly, nmap, wireshark, and tcpdump are just a few tools also 'freely' available that do similar things on a different level. Whatever the fedora board is smoking I want some.

The flip side of the coin though is that nmap, wireshark, and tcpdump all have uses beyond pen-testing or hacking. nmap can be used to help diagnose routing issues (I've actually used it for that), as well as for veryifying your network map, and other similar uses.

Wireshark is similarly very useful for debugging. For example, it can quickly help you determine that your software is creating malformed packets, or determine exactly what order your packets are being sent, or exactly what they contain. tcpdump is similar.

Even password cracking tools like jack the ripper can be used for purposes other than hacking or pen-testing. One possible such use (despite being a bit questionable) is ensuring minimum password strength, by running it for a fixed amount of time, and rejecting any passwords it can crack in that timeframe.

The difference is that sqlninja really has no use beyond hacking or pen-testing. It does not even pretend it might have other uses.

That all said, I'm not saying that refusing to package it is the right course of action. Indeed that seems questionable at best. I'm merely pointing out how sqlninja is different from the other tools you mentioned.

> nmap can be used to help diagnose routing issues (I've actually used it for that)

If you use nmap to diagnose routing, you are doing something wrong. Heard of mtr and looking glasses?

> Wireshark is similarly very useful for debugging. For example, it can quickly help you determine that your software is creating malformed packets, or determine exactly what order your packets are being sent, or exactly what they contain. tcpdump is similar.

If you use nmap to diagnose routing, you are doing something wrong. Heard of mtr and looking glasses?

Looking glasses are very useful. MTR is also a prefered tool. But nmap does have a few good tricks up its sleeve. As the name suggests, it can help with mapping out networks, which unfortunately is often necessarily when diagnosing routing issues through an unfamiliar public network. After all, many networks don't provide looking glass services, or other ways of getting much information about the network map.

> Wireshark is similarly very useful for debugging. For example, it can quickly help you determine that your software is creating malformed packets, or determine exactly what order your packets are being sent, or exactly what they contain. tcpdump is similar.

As both use libpcap, they would be.

I would certainly hope so, I mean pretty much all packet sniffers seem to be based on libpcap. Of co

While I understand that you aren't passing judgment, there are reasons for cracking other than pen-testing
I have a friend who works as a computer techie at a school. In most cases, if you were to ask a teacher what type of computer they had, they would answer "a white one".
What he often finds is that when a teacher wants something fixed (read: they somehow found their way to the control panel and messed something up, or want something installed) on their laptop, they give it to him and then leave withou

Fair enough. I most certainly have used LiveCDs to bypass password checks. The case of this specific tool has fewer indisputably acceptable non-(pen-test) use cases.

For example, while it could be used to penetrate a rouge MS SQL Server install in your network, you can disconnect the device forcibly (if it is not one of yours), or physically go to the device, and kill the server. MS SQL Server is not protected against access by the admins of the machine it is running on.

As a white hat developer, I've found tools such as nmap, wireshark and tcpdump useful in my daily life. While I can see that this tool can be used by security researchers, I cannot imagine a scenario where I would use a tool such as this one. Forget about the security objections of Fedora. On its own, this tool is a highly specialized utility. It is not something the everyday user or developer really needs.

Why are these guys surprised that a project backed by a company rejected there hacking tool. Firstly the name 'sqlninja', I mean come on, it's got to be a hacking tool, can you imagine that on the front page of a news paper 'evil open source firm ok's sqlninja'. Then when I googled it, the website declares it is a 'sqlninja - a SQL Server injection & takeover tool'. In no way do they pretend it is for testing or whatnot. They had to reject the tool. And what business is red hat in, oh year selling a

If the people at SQLNinja really want a to have it easy to use/install on a redhat machine all they have to do is make their own RPM file and host it themselves. Currently, it looks like all they have available is the source code available. Although I don't know why they made such a request when they don't have any 'easy' (RPM/DEB file) installation process available yet. I'd think RH would tell them to make a RPM file to submit before rejecting them on philosophical grounds.

Isn't that kind of the point of things being open? That you don't have to agree with the way things are done -- you have the source, change/fix/fork it yourself.

In other words -- non-story. Those that want this specific tool (black, white,or grey hat) will know how to get it. It's not like anyone capable of using such tools cannot handle tar, make, and make install.

True. The net effect of the Board's decision, so far as people actually using said tool, will be nil. My guess is that this is some kind of "cover their collective asses" move, over perceived liability for distributing such software. Given the current legal climate in many countries towards "hacking" tools (doesn't Germany take a rather hard line there?) they may actually have a legitimate concern. I don't know, not a lawyer, etc. etc.

Smith said the language is intended to clarify its stance on a class of software that can be used both to secure and penetrate protected networks.

There really should be no "stance", in that sense. They're blaming the to

Smith said the language is intended to clarify its stance on a class of software that can be used both to secure and penetrate protected networks.....If a piece of software can be used to test a network for vulnerability, it can likely be used to penetrate said network.

This software does not secure or test anything. It's used to a exploit SQL injection vulnerability found by other means. Go read its sourceforge page which says.

There are a lot of other SQL injection tools out there but sqlninja, instead of extracting the data, focuses on getting an interactive shell on the remote DB server and using it as a foothold in the target network

Smith said the language is intended to clarify its stance on a class of software that can be used both to secure and penetrate protected networks.....If a piece of software can be used to test a network for vulnerability, it can likely be used to penetrate said network.

This software does not secure or test anything. It's used to a exploit SQL injection vulnerability found by other means. Go read its sourceforge page which says.

There are a lot of other SQL injection tools out there but sqlninja, instead of extracting the data, focuses on getting an interactive shell on the remote DB server and using it as a foothold in the target network

I'm afraid that I don't understand your point. Are you saying that, because this isn't a program that just goes "oh look, I think I found a vulnerability" but actually exploits it, that it's any less valuable to someone in charge of network security?

I'm afraid that I don't understand your point. Are you saying that, because this isn't a program that just goes "oh look, I think I found a vulnerability" but actually exploits it, that it's any less valuable to someone in charge of network security?

If you're trying to secure a system, a tool which identifies the vulnerabilities is of great use. This tool doesn't find the vulnerabities, you have to do that yourself. Once you find a vulnerable webpage, you use this tool to exploit it.

It's kind like checking a building for open doors, actively trying to jimmy the doors, or see how easily the locks can be picked. That's valuable as it identifies weaknesses. This tool would be more akin to going in and stealing things after someone else pointed out the unlocked door.

Of course no-one has pointed out the political angle. I doubt RedHat wants to host a tool in the repositories whose stated purpose is for compromising Microsoft SQL databases.

So, in other words, this is another in a long line of questionable and sensationalistic articles by The Register? I don't even bother to read anything they publish anymore, because their standards are so low these days.

Everything seemed to go downhill starting with that series of articles they ran a few years ago where they published truly bizarre and (AFAIK) unsubstantiated claims about some dot-com CEO.

"It's not like anyone capable of using such tools cannot handle tar, make, and make install."

Hopefully not on fedora. You shouldn't install from source on binary based systems the package manager doesn't know about your install and this can lead to library incompatibilities. In the best case this will cause something to break, in the worst case it will lead to application instability and bitrot similar to that seen on windows.

I can kind of understand the decision. If someone gets hacked, is the Fedora distribution liable for providing the tool? (Similar to how you can be charged with Accessory to Murder for providing a weapon, or an ISP is now somehow responsible for any illegal traffic.) They probably want to cover their butts, but it also seems like unfair censorship.

The difference between tcpdump, nmap, and sqlninja is that tcpdump and nmap have a lot of uses (is my port open?). SQLNinja is marketed entirely as an "SQL Server injection & takeover tool." Obviously marketing isn't the most important thing, but penetration testing is about all it can do (unless you're dumb and actually want to take over other people's computers). Fedora users aren't primarily penetration testers.

From reading the minutes, it seems like the Fedora board rejected it, not because it's a hacker tool (they include jack-the-ripper), but because it doesn't provide any real benefit for their customer base, certainly not enough to outweigh the small legal risk entailed. Fedora isn't a penetration testing distro, it's a server distro. They don't include metasploit either, there's just no demand for it, and the authors of metasploit don't need to get attention for their product by begging people to put it in their distro.

The difference between tcpdump, nmap, and sqlninja is that tcpdump and nmap have a lot of uses (is my port open?).

Yes of course, but there are also plugins for e.g. nmap that will give you 'recommendations' for _said_ open ports on target which in the end is also a 'penetration tool' which was one of the reasons for not adding this particular package. So how is that so much different ?

The reason the Fedora board gave was (and if you had read the link you would know this) is that the nmap is used probably the majority of the time to check if your own ports are open. Of course even a compiler can be used as a penetration tool, so the ability to use something as a penetration tool is not enough to keep it from the distro, which I think you're getting at.

Really, from reading the minutes, I think they basically decided it wasn't useful enough for their user base. You might disagree, but I t

Good job. You have demonstrated your capability to read, cut and paste a sentence from the minutes onto slashdot. Do you also have the capability to explain why you think that sentence is particularly important? Please do.

Good job. You have demonstrated your capability to read, cut and paste a sentence from the minutes onto slashdot. Do you also have the capability to explain why you think that sentence is particularly important? Please do.

Was just stating from the minutes one of the argumentations that were posted for adding the package, which I see and view as significant. You implied earlier that I should have read the minutes, which I did. I have to use a Fedora box at work so yes I read them all the time, so I can keep up with the binary distro world.

Since you asked, I feel that is an important argument to the package itself and the boards reasoning as a whole, look at some of the other packages that are provided and what they can be use

ok, so you are a Fedora user. That's good, we can learn something. Although you are only a sample of one, you are representative of some portion of the Fedora user base. So do you feel, that as a Fedora user, you are planning on using this tool, and thus this decision harms you (somewhat minimally, of course)?

My perception is that this tool isn't something you would really install on a Fedora system, if you were doing penetration testing you would use something else, but I could be wrong.

The difference between tcpdump, nmap, and sqlninja is that tcpdump and nmap have a lot of uses (is my port open?).

Yes of course, but there are also plugins for e.g. nmap that will give you 'recommendations' for _said_ open ports on target which in the end is also a 'penetration tool' which was one of the reasons for not adding this particular package. So how is that so much different ?

Because the sole purpose of SQLninja is to exploit a SQL injection vulnerability once detected by other means, not to actually discover them. To me, that is a black hat tool with no redeeming use as a pen testing program.

Because the sole purpose of SQLninja is to exploit a SQL injection vulnerability once detected by other means, not to actually discover them. To me, that is a black hat tool with no redeeming use as a pen testing program.

Given that security best comes in layers, it would be good to know how much damage a successful injection can do, and design your system in accordance, including alerts for people attempting to use this tool.

That's a good point, but as the Fedora board mentioned, the sensational name alone isn't enough to keep it out, since jack-the-ripper is in the distribution. I really think they left it out because they didn't see it as being particularly useful (for their user base).

BTW, I am fairly certain that your sig is the reason Nancy Pelosi keeps getting re-elected in San Francisco......yeah, she's just like a Republican....but at least she's not a Republican (although she did represent fairly well in the last yea

The geek has a genius for putting names to his projects that are certain to raise red flags.

The Gimp carries baggage into the OSX and Windows shop that the charity providing services for the disabled does not need or want. Fedora and Red Hat need to maintain their credibility in the enterprise environment.

Time and money spent in explanation and recovery - PR - can always be put to better uses.

What on earth makes you think that? I've never seen any comment from the fedora project to the effect of "this is a server distro". In fact given the bleeding-edge approach Fedora has to including new packages I would suggest that it's not really suited to being a server distro at all. Good enough on the desktop, though.

Every server and desktop Linux box has by definition a "sysadmin", except maybe those where the admin access password has been permanently forgotten (for desktop Ubuntu this means using automatic login without user password) and updates are set to happen automatically. Whether sysadmin job is being done or neglected, that's another matter, but the job exists.

Doing an actual SQL injection attack is a task that doesn't exist for like 99.9% of Linux users. Not to mention, if installing the tool is a problem, t

They really aren't exposing themselves any more to suits by including it then not as long as it has a legitimate purpose and there is a statement to some effect that they only intend it to be used that way. ( else every gun and knife maker in the world would be gone by now )

"I can kind of understand the decision. If someone gets hacked, is the Fedora distribution liable for providing the tool? (Similar to how you can be charged with Accessory to Murder for providing a weapon, or an ISP is now somehow responsible for any illegal traffic.)"

When was the last time Colt or Smith & Wesson were charged with Accessory to Murder?

Nobody seems to be invoking Godwin, just saying that the justification used here sounds a bit off. Had it been "We can't include everything that exists and this package seems to be of limited interest", nobody would even blink.

Sure. Do the rest of us have a right to call these people out if we think they're trying to make a mountain out of a molehill? Likewise certain. You seem to be trying to deny the AC the same rights you demand for yourself.

The fact is that post-Grokster, the way a program is marketed is legally significant, and the way this program has been marketed is definitely a bit sketchy, IMO. Grokster didn't lose because their program lacked legal uses; it lost because they promoted the illegal ones.

The fact is that post-Grokster, the way a program is marketed is legally significant, and the way this program has been marketed is definitely a bit sketchy, IMO. Grokster didn't lose because their program lacked legal uses; it lost because they promoted the illegal ones.

By the same token, if you even imply that you're vetting the legality of packages, it tends to come back to haunt you when someone finds an obscure illegal use for foo that you did include. That's not to say that you can't internally equate probably used illegally with not very interesting.

The fact is that post-Grokster, the way a program is marketed is legally significant, and the way this program has been marketed is definitely a bit sketchy, IMO. Grokster didn't lose because their program lacked legal uses; it lost because they promoted the illegal ones.

By the same token, if you even imply that you're vetting the legality of packages, it tends to come back to haunt you when someone finds an obscure illegal use for foo that you did include. That's not to say that you can't internally equate probably used illegally with not very interesting.

I think this wasn't about use, but about marketing. So you should say, if someone finds some other packet you included officially marketed as suitable for illegal uses. This can of course happen, but isn't as likely as finding illegal use for, say, a compiler that can be used for writing or downloading and compiling a program that hacks various government computers and initiates a nuclear war.

it tends to come back to haunt you when someone finds an obscure illegal use for foo that you did include.

No, obscurity doesn't matter. The earlier Betamax case established (thank you Sony) that a tool can be blatantly used primarily for illegal purposes, and still be perfectly legal as long as there exist substantial legal uses. The Grokster case merely narrowed that by establishing that you cannot promote the illegal uses.

The problem is on the other side of it. If you have a policy of excluding tools that are rimarily for illegal uses, suddenly people try to sue you if one slips through the cracks. OTOH, if you use popularity, utility, or other measures instead, it doesn't come up.

Perhaps that shouldn't (since it is more than a bit self defeating), but it seems to be the case.

Censorship can be by a government, or it can be by a private party. In the latter case, arbitrary censorship is usually OK. For governments, they usually have to meet some reasonable constitutional or judicial standard.

The MPAA ratings are not done by any government body, but they still censor movies when someone in the movie says fuck, copulates with same/different sex or mindlessly kills people.Censorship is not just when governments do it. And no one prevents me to say "fuck" either. Yet.

The problem per se is not that Fedora removes a package. The problem is their reasoning especially when there tons of other penetration testing tools still existing in Fedora. It's their choice if they want a non-offensive, family frie

The MPAA ratings are not done by any government body, but they still censor movies...

Technically the MPAA is a rating board. They don't actually cut anything. The power arises from the distribution chain that won't widely screen any movie with a rating above PG-13. I've even seen a few movies distributed unrated if the director has a loyal enough following and not terribly high commercial prospects to begin with.

If more consumers chose to ignore the ratings, we'd be better off. You can usually figure out whether a movie is suitable from any competent film review. All it takes is three

I swear, some people really need to read about the concept of censorship. I wasn't aware that Fedora was a government entity, and that they just banned an app from ever being used.
Guess what. You can always install this app yourself, if you really want to use it. I'm sure someone wanting a hacking tool can figure out how to install software...

Linux prides itself on having all hacking tools available so system administrators know how to attack so they know how to defend,
and system admins are godly people that do not like to be told what to do, so 2 things will happen, distro switch or config their own
repositories where they can still get them.
I think fedora has forgotten target audience. Its like taking food away from a baby, good luck with that.

Red Hat is in the business of selling linux support to companies. It is not too surprising that some of those companies (who very well may have been the target of SQL injection exploits) have said in return for our businesses, remove all software that supports SQL injection from your repos. This is a useless measure for sure, but it may make the companies happy. I would suspect this is the case given the unanimity of the board's approval.

You may be right, but it would be especially ironic since if those companies would have had ninjaSQL, and used it effectively in testing their networks, then they wouldn't have been a victim of SQL exploits in the first place...

You may be right, but it would be especially ironic since if those companies would have had ninjaSQL, and used it effectively in testing their networks, then they wouldn't have been a victim of SQL exploits in the first place...

This isn't a tool to find vulnerabilities. It's a tool to exploit them once found.

From the sourcforge page for this tool

"Sqlninja's goal is to exploit SQL injection vulnerabilities on web applications that use Microsoft SQL Server as back end. It is released under the GPLv2.

There are a lot of other SQL injection tools out there but sqlninja, instead of extracting the data, focuses on getting an interactive shell on the remote DB server and using it as a foothold in the target network. In a nutshell, here's what it does: "

As you probably have figured out, sqlninja does not look for SQL injection vulnerabilities. Again, there are already several tools that perform that task already.

"This isn't a tool to find vulnerabilities. It's a tool to exploit them once found."

How do you expect to test if someone can break into your system with SQLNinja without running it and attempting to break in? How do you plan on proving to upper management that there really is a vulnerability, and that your conjecture that you could break in is something more than mere conjecture?

"This isn't a tool to find vulnerabilities. It's a tool to exploit them once found."

How do you expect to test if someone can break into your system with SQLNinja without running it and attempting to break in? How do you plan on proving to upper management that there really is a vulnerability, and that your conjecture that you could break in is something more than mere conjecture?

Valid points. Still doesn't mean that Redhat should include this in their repositories any more than they should include virus building tools.

"This isn't a tool to find vulnerabilities. It's a tool to exploit them once found."

How do you expect to test if someone can break into your system with SQLNinja without running it and attempting to break in? How do you plan on proving to upper management that there really is a vulnerability, and that your conjecture that you could break in is something more than mere conjecture?

How do you expect to test if someone can install a botnet on your servers via running IE as admin to visit porn sites unless you use IE on your servers as admin to visit porn sites?

Being reasonable requires we be willing to draw lines and pass judgement. There are some tools that are mostly legitimate, some that see substantial illegitimate use, and some that are mostly illegitimate. It's fine for a Linux distro to decide not to ship with (or include in repositories) tools that are mostly used for illegitimate ends, even if they have some theoretical legitimate uses. They're not under any obligation to package everything, and "stuff that's mostly used to do harm" is just as reasonable to filter out as "things with ugly licenses".

By analogy, it is usually hard to get lockpicking tools, assault weapons/vehicles, nuclear materials, radar detectors, unsafe foods, homemade alcohols, and many other things in most countries. Can you manage it? Usually, either by legitimate means if you can get a permit, or by making them yourself.

This is entirely different (and much more mild) than blacklisting those applications.

The thing I like about Unix is that everything is designed to give me more power. No "Oh, you can't do that because you might hose your computer." or "You can't have that because you could use it for hacking!". If I want something done, my computer damn well does it.

From this perspective, rejecting a package from a repository because it gives the user the wrong sort of power is an alien concept. Fortunately, the idea of open source is that something like this is never permanent - it lasts only until someone includes the package in a competing repository.

Since I tend not to trust 3rd party repositories, it means that it lasts until I switch to another distro.

While I'll be the first to acknowledge that this is clearly a "CYA" move on Fedora's part, I don't see why it is such a big deal. Ubuntu/Debian don't appear to have this tool in their repositories, and I'm pretty sure SuSE doesn't either, so it's not like Fedora is bucking a consensus. If there's enough demand for it, RPM Fusion will probably pick it up.

Furthermore, if the person responsible for your network vulnerability testing doesn't have the basic skills to install it from the upstream sources, is this really the caliber of person you want to trust with your network security?

Disclaimer: I used to work for Red Hat and personally know some of the board.

SQLNinja is not a security analysis tool. It is no more useful for telling you if your database app is insecure than a blowtorch is for telling you if you have a gas leak. SQL injection vulnerabilities are *trivial* to detect with simple input fuzzing.

SQLNinja is certainly a legitimately useful *demonstration* tool for developers and administrators to show their bosses just how severe their problems are, such that they might be prioritized, but it's designed for software that doesn't even run on Fedora, so it provides negligible benefit to the Fedora community. Anyone who knows enough to search for "SQL injection tool" can find it and install it, so there's really not much of a barrier here, but leaving it out of the distribution reduces the risk of Fedora being used as a gateway to the fat wallet of Red Hat in any litigation, a problem which most community distributions do not suffer from.

Fedora takes a lot of moral stands, but they're ultimately about things that will somehow benefit the Fedora community in the long term, and there's really no foreseeable payoff here, or certainly none that overrides the fantastic headache it could incur. I certainly can't fault them for picking their battles.

to continue this trend, it would be a bye bye to security. Every single "hacker tool" is a 2 edged sword, it can be used for both good and bad. Just like almost anything can be used for good and bad. Should we ban knives because some people use them to hack'n'slice living meat (people) instead of dead?

Maybe we should just lock ourselves into soft rooms, there's the least likelyness for using anything for bad, and problem will soon be completely solved as we would die out as a race, no more people to do bad